Merge pull request #1056 from trheyi/main

Enhance OAuth authorization URL handling and improve public configura…

openapi/signin/api.go

@@ -71,6 +71,8 @@ func getOAuthAuthorizationURL(c *gin.Context) {
 	state := c.Query("state")
 	locale := c.Query("locale")
 
+	fmt.Println("redirect_uri", redirectURI)
+
 	// Get full configuration
 	config := GetFullConfig(locale)
 	if config == nil {
@@ -138,6 +140,9 @@ func getOAuthAuthorizationURL(c *gin.Context) {
 	params.Add("redirect_uri", redirectURI)
 	params.Add("state", state)
 
+	fmt.Println("client_id", provider.ClientID)
+	fmt.Println("redirectURI", redirectURI)
+
 	// Add scopes
 	if len(provider.Scopes) > 0 {
 		params.Add("scope", strings.Join(provider.Scopes, " "))

openapi/signin/signin.go

@@ -331,46 +331,105 @@ func replaceENVVar(value string) string {
 
 // createPublicConfig creates a public version of the configuration without sensitive data
 func createPublicConfig(fullConfig *Config) Config {
-	publicConfig := *fullConfig
+	// Perform deep copy to avoid modifying the original fullConfig
-
+	publicConfig := Config{
-	// Remove sensitive data from captcha configuration
+		Title:       fullConfig.Title,
-	if publicConfig.Form != nil && publicConfig.Form.Captcha != nil && publicConfig.Form.Captcha.Options != nil {
+		Description: fullConfig.Description,
-		// Create a new options map without sensitive fields
+		SuccessURL:  fullConfig.SuccessURL,
-		publicOptions := make(map[string]interface{})
+		FailureURL:  fullConfig.FailureURL,
-		for key, value := range publicConfig.Form.Captcha.Options {
-			// Only include non-sensitive fields
-			switch key {
-			case "sitekey", "theme", "size", "action", "cdata":
-				// These are safe to expose to frontend
-				publicOptions[key] = value
-			case "secret":
-				// Remove secret field - this should never be exposed to frontend
-				continue
-			default:
-				// For unknown fields, be conservative and exclude them
-				continue
-			}
-		}
-		publicConfig.Form.Captcha.Options = publicOptions
 	}
 
-	// Remove sensitive data from third party providers
+	// Deep copy Form configuration
-	if publicConfig.ThirdParty != nil && publicConfig.ThirdParty.Providers != nil {
+	if fullConfig.Form != nil {
-		publicProviders := make([]*Provider, len(publicConfig.ThirdParty.Providers))
+		publicConfig.Form = &FormConfig{
-		for i, provider := range publicConfig.ThirdParty.Providers {
+			ForgotPasswordLink: fullConfig.Form.ForgotPasswordLink,
-			publicProvider := Provider{
+			RememberMe:         fullConfig.Form.RememberMe,
-				ID:        provider.ID,
+			RegisterLink:       fullConfig.Form.RegisterLink,
-				Title:     provider.Title,
+			TermsOfServiceLink: fullConfig.Form.TermsOfServiceLink,
-				Logo:      provider.Logo,
+			PrivacyPolicyLink:  fullConfig.Form.PrivacyPolicyLink,
-				Color:     provider.Color,
+		}
-				TextColor: provider.TextColor,
+
-				// Only expose display fields for frontend
+		// Deep copy Username configuration
-				// Remove sensitive fields: ClientID, ClientSecret, ClientSecretGenerator, Scopes, Endpoints, Mapping
+		if fullConfig.Form.Username != nil {
+			publicConfig.Form.Username = &UsernameConfig{
+				Placeholder: fullConfig.Form.Username.Placeholder,
+				Fields:      append([]string(nil), fullConfig.Form.Username.Fields...),
+			}
+		}
+
+		// Deep copy Password configuration
+		if fullConfig.Form.Password != nil {
+			publicConfig.Form.Password = &PasswordConfig{
+				Placeholder: fullConfig.Form.Password.Placeholder,
+			}
+		}
+
+		// Deep copy Captcha configuration with sensitive data removal
+		if fullConfig.Form.Captcha != nil {
+			publicConfig.Form.Captcha = &CaptchaConfig{
+				Type: fullConfig.Form.Captcha.Type,
 			}
 
-			publicProviders[i] = &publicProvider
+			if fullConfig.Form.Captcha.Options != nil {
+				// Create a new options map without sensitive fields
+				publicOptions := make(map[string]interface{})
+				for key, value := range fullConfig.Form.Captcha.Options {
+					// Only include non-sensitive fields
+					switch key {
+					case "sitekey", "theme", "size", "action", "cdata":
+						// These are safe to expose to frontend
+						publicOptions[key] = value
+					case "secret":
+						// Remove secret field - this should never be exposed to frontend
+						continue
+					default:
+						// For unknown fields, be conservative and exclude them
+						continue
+					}
+				}
+				publicConfig.Form.Captcha.Options = publicOptions
+			}
+		}
+	}
+
+	// Deep copy Token configuration
+	if fullConfig.Token != nil {
+		publicConfig.Token = &TokenConfig{
+			ExpiresIn:           fullConfig.Token.ExpiresIn,
+			RememberMeExpiresIn: fullConfig.Token.RememberMeExpiresIn,
+		}
+	}
+
+	// Deep copy ThirdParty configuration with sensitive data removal
+	if fullConfig.ThirdParty != nil {
+		publicConfig.ThirdParty = &ThirdParty{}
+
+		// Deep copy Register configuration
+		if fullConfig.ThirdParty.Register != nil {
+			publicConfig.ThirdParty.Register = &RegisterConfig{
+				Auto: fullConfig.ThirdParty.Register.Auto,
+				Role: fullConfig.ThirdParty.Register.Role,
+			}
+		}
+
+		// Deep copy Providers with sensitive data removal
+		if fullConfig.ThirdParty.Providers != nil {
+			publicProviders := make([]*Provider, len(fullConfig.ThirdParty.Providers))
+			for i, provider := range fullConfig.ThirdParty.Providers {
+				publicProvider := Provider{
+					ID:        provider.ID,
+					Title:     provider.Title,
+					Logo:      provider.Logo,
+					Color:     provider.Color,
+					TextColor: provider.TextColor,
+					// Only expose display fields for frontend
+					// Remove sensitive fields: ClientID, ClientSecret, ClientSecretGenerator, Scopes, Endpoints, Mapping
+				}
+
+				publicProviders[i] = &publicProvider
+			}
+			publicConfig.ThirdParty.Providers = publicProviders
 		}
-		publicConfig.ThirdParty.Providers = publicProviders
 	}
 
 	return publicConfig